Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 05:34
Behavioral task
behavioral1
Sample
ebad1f6a6d31d3bc41c4dd032c65b5a9.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ebad1f6a6d31d3bc41c4dd032c65b5a9.exe
-
Size
3.8MB
-
MD5
ebad1f6a6d31d3bc41c4dd032c65b5a9
-
SHA1
27a35676e86151d4f9f48ac2ca97a7bffdca79bd
-
SHA256
36316d947ad6892d08d04e0508b0cc08640f64e3b22b7e28c0830862cd9a151b
-
SHA512
43d46663220b3e433274ef58a074e74929d7075d4d4eebdc005e1671154bb5005aee95d697eb72fb0ec4f3c91c4044dd298a3e4574359ad2de0f8804266502e4
-
SSDEEP
98304:U/mPsUJQZ5BLHYl3vKQLLh4JE8Ls+0bGAN:PkuUL41td4JLEZ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
ebad1f6a6d31d3bc41c4dd032c65b5a9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ebad1f6a6d31d3bc41c4dd032c65b5a9.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ebad1f6a6d31d3bc41c4dd032c65b5a9.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ebad1f6a6d31d3bc41c4dd032c65b5a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ebad1f6a6d31d3bc41c4dd032c65b5a9.exe -
Processes:
resource yara_rule behavioral2/memory/3452-0-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-3-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-2-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-4-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-6-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-5-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-7-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-8-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-9-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-10-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-11-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-12-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-13-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-14-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-15-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-16-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-17-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-18-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-19-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-20-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-21-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-22-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida behavioral2/memory/3452-23-0x00007FF7ED120000-0x00007FF7EDB5D000-memory.dmp themida -
Processes:
ebad1f6a6d31d3bc41c4dd032c65b5a9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ebad1f6a6d31d3bc41c4dd032c65b5a9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
ebad1f6a6d31d3bc41c4dd032c65b5a9.exepid process 3452 ebad1f6a6d31d3bc41c4dd032c65b5a9.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 3600 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3600 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebad1f6a6d31d3bc41c4dd032c65b5a9.exe"C:\Users\Admin\AppData\Local\Temp\ebad1f6a6d31d3bc41c4dd032c65b5a9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3452
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:1000